cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code

[Severity: LOW]

### Impact
_What kind of vulnerability is it? Who is impacted?_

An information leakage vulnerability is present in [`cdo-local-uuid`](https://pypi.org/project/cdo-local-uuid/) at version `0.4.0`, and in [`case-utils`](https://pypi.org/project/case-utils/) in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`.

The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`.  Henceforth, both will be called `local_uuid()`.

`local_uuid()` generates UUIDv5s using a deterministic pseudorandom number stream.  This was written to make graph application demonstrations generate consistent, version-controllable output with minimal noise caused by demonstration re-runs.  Part of the information used to keep individual examples' generated output distinct from one another is seed information from the caller's environment, particularly the program's argument vector.  The present working directory is also included as part of the seed information, but for reasons including maintaining user environment privacy, as well as keeping generated identifiers consistent regardless of where a source tree is housed on a user's file system, the present working directory is trimmed from the left to exclude path information outside of a supplied "Top" source directory.  (In context of the Make scripting language, this "top" directory is typically in a variable called `top_srcdir`.  In context of Git-based project management, this directory is expected to be the root directory of a freshly "Cloned" project, e.g., where `.git` is stored.)

Under certain conditions, a user's present working directory, as an absolute path, was incorporated into seed data for the `local_uuid()` deterministic pseudorandom number stream.  This violates an expectation made in the documented purpose of the `local_uuid()` function, and leaks information about a calling user's environment.

The conditions are:

* Given a project with top source directory `top_srcdir`, for instance `/home/user1/Documents/Project1`;
* Given a Python script housed directly in `top_srcdir`, for instance at `${top_srcdir}/example.py`, written to support the deterministic mode of `local_uuid()`;
* Given a call to that Python script that follows the documentation for `local_uuid()`;

The absolute path for `top_srcdir` was then included in the seed information for the UUIDv5 stream, when what was intended was a relative path spelling.  That is, instead of `./example.py` being in the seed data, `/home/user1/Documents/Project1/example.py` was in the seed data.

This does not leak the present working directory directly.  But, given other knowledge of how a program had been called to generate data using `local_uuid()` under these conditions, it becomes possible to determine that a chosen path can lead to a known UUIDv5 value.  Note that it is not necessarily knowable that the chosen path is the *only* solution to a sequence reconstruction; but, the path can be confirmed to be *a* solution.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

The issue has been patched, in the `cdo-local-uuid` source repository and the `case-utils` source repository.

Users should upgrade to any of these versions minimally:

* `case-utils == 0.5.1`
* `case-utils == 0.6.1`
* `case-utils == 0.7.1`
* `case-utils == 0.8.1`
* `case-utils == 0.9.1`
* `case-utils == 0.10.1`
* `case-utils == 0.11.1`
* `case-utils == 0.12.1`
* `case-utils == 0.13.1`
* `case-utils == 0.14.1`
* `case-utils >= 0.15.0`
* `cdo-local-uuid == 0.5.0`

All `case-utils` releases that contain the patch have the commit `ea630cce66b26dae6d7fa7e02451d6e25456a5f2` in their Git history.  Anyone interested in confirming the presence of this commit in a certain branch or tag can run the following test (written in Bash), substituting the desired branch name for the assigned value of `my_git_ref_of_interest`:

```bash
#!/bin/bash
# Present working directory ($PWD) should be in a clone of this repository:
# https://github.com/casework/CASE-Utilities-Python
my_git_ref_of_interest=main
test \
  "xea630cce66b26dae6d7fa7e02451d6e25456a5f2" \
  == \
  "x$(git merge-base ea630cc ${my_git_ref_of_interest})"
echo $?  # Should print '0'
```

Note that other releases have been posted atop some of those minimal versions recommended for upgrading, named, e.g., `0.5.1.post0`.  These releases were posted to update internal library version numbers, and otherwise contain no functional changes, in accordance with Python Packaging guidance:

* https://packaging.python.org/en/latest/specifications/version-specifiers/#post-release-separators

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

If the script calling `cdo_local_uuid.local_uuid()` is moved out of the "Top" source directory, the issue is addressed.

### References
_Are there any links users can visit to find out more?_

The issue is addressed in this Pull Request:

* https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/3

Tests to reproduce the issue's conditions and confirm it has been addressed are in this Pull Requested:

* https://github.com/Cyber-Domain-Ontology/CDO-Utility-Local-UUID/pull/4

<!--
CVSS3.1 vector determined by rubric diagrams at this page:
https://www.first.org/cvss/v3.1/user-guide
-->


Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts

[Severity: MEDIUM]

### Summary
An authenticated and unauthorized user can access the GDPR data extraction feature and query over the information returned, leading to customer data exposure.

### Details
Permissions do not seem to be enforced when reaching the `/admin/customermanagementframework/gdpr-data/search-data-objects` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. It seems that the access control is not enforced in this place : <https://github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/GDPRDataController.php#L38>

### PoC

In order to reproduce the issue, the following steps can be followed:

1. As an administrator :
  a. Create a role without any permission through Settings → User & Roles → Roles in the administration panel
  b. Create an user through Settings → User & Roles → Users and assign it the unprivileged role previously created
2. Log out the current administrator and log in with this new user
3. Access to the following endpoint `https://pimcore_instance/admin/customermanagementframework/gdpr-data/search-data-objects?id=&firstname=&lastname=&email=&page=1&start=0&limit=50` and the results will be returned to this unauthorized user.

### Impact
An unauthorized user can access PII data from customers without being authorized to.


Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list

[Severity: MEDIUM]

### Summary
An authenticated and unauthorized user can access the list of potential duplicate users and see their data.

### Details
Permissions do not seem to be enforced when reaching the `/admin/customermanagementframework/duplicates/list` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. It seems that the access control is not enforced in this place :
<https://github.com/pimcore/customer-data-framework/blob/b4af625ef327c58d05ef7cdf145fa749d2d4195e/src/Controller/Admin/DuplicatesController.php#L43>

### PoC
In order to reproduce the issue, the following steps can be followed :

1. As an administrator :
  a. Create a role without any permission through Settings → User & Roles → Roles in the administration panel
  b. Create an user through Settings → User & Roles → Users and assign it the unprivileged role previously created
2. Log out the current administrator and log in with this new user
3. Access to the following endpoint `https://pimcore_instance/admin/customermanagementframework/duplicates/list` and the results will be returned to this unauthorized user

### Impact
An unauthorized user can access PII data from customers without being authorized to.


Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list

[Severity: MEDIUM]

### Summary
An authenticated and unauthorized user can access the back-office orders list and be able to query over the information returned.

### Details
Permissions do not seem to be enforced when reaching the `admin/ecommerceframework/admin-order/list` endpoint allowing an authenticated user without the permissions to access the endpoint and query the data available there. It seems that the access control is not enforced in this place :

<https://github.com/pimcore/ecommerce-framework-bundle/blob/ff6ff287b6eb468bb940909c56970363596e5c21/src/Controller/AdminOrderController.php#L98>

__Note__ :  Testing this vulnerability requires a fully configured ecommerce website, but it looks vulnerable as when requesting the endpoint the data seem returned (and when looking at the source code nothing seems to validate the permissions on the specified endpoint).

### PoC
In order to reproduce the issue, the following steps can be followed :

1.  As an administrator :
  a. Create a role without any permission through Settings → User & Roles → Roles in the administration panel
  b. Create an user through Settings → User & Roles → Users and assign it the unprivileged role previously created
2. Log out the current administrator and log in with this new user
3. Access to the following endpoint `https://pimcore_instance/admin/ecommerceframework/admin-order/list` and the results will be returned to this unauthorized user

### Impact
An unauthorized user can access back-office orders without being authorized to.


Microsoft.Data.SqlClient and System.Data.SqlClient vulnerable to SQL Data Provider Security Feature Bypass

[Severity: HIGH]

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability


Cache variables with the operations when transforms exist on the root level even if variables change in the further requests with the same operation

[Severity: MEDIUM]

When you have transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in all following requests until the cache evicts DocumentNode.

Let's say if a token is sent via variables, the following requests will act like the same token is sent even if the following requests have different tokens.

This can cause a short memory leak but it won't grow per each request but per different operation until the cache evicts DocumentNode by LRU mechanism.


Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler

[Severity: MEDIUM]

### Summary
Missing check vulnerability in the static file handler allows any client to access the files in the server's file system

### Details
When `staticFiles` is set in the `serve` settings in the configuration file, the following handler doesn't check if `absolutePath` is still under the directory provided as `staticFiles`;

```ts
  if (staticFiles) {
    router.get('/:relativePath+', async request => {
      let { relativePath } = request.params;
      if (!relativePath) {
        relativePath = 'index.html';
      }
      const absolutePath = path.join(baseDir, staticFiles, relativePath);
      if (absolutePath.includes(staticFiles) && (await pathExists(absolutePath))) {
        const readStream = fs.createReadStream(absolutePath);
        return new Response(readStream as any, {
          status: 200,
        });
      }
      return undefined;
    });
 ```

### Example scenario
To reproduce it, set `staticFiles` to the relative path of a directory in `.meshrc.yml`;

```yml
serve:
   staticFiles: ./public
```

Then start the server with `mesh dev`, and browse to `/..%2fpackage.json` then you will see the content of `package.json`. You can even go deeper to see sensitive data; `/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd`

### Impact and solution
If `staticFiles` is set under `serve` in the configuration file. you have two options to fix vulnerability;

- Update `@graphql-mesh/cli` to a version higher than `0.82.21`, and if you use `@graphql-mesh/http`, update it to a version higher than `0.3.18`
- Remove `staticFiles` option from the configuration, and use other solutions to serve static files.

### Credits
Thanks [alanwillms@gmail.com](mailto:alanwillms@gmail.com) for reporting this vulnerability with details


[HTTP Request Smuggling] CVE-2024-21733 Apache Tomcat HTTP Request Smuggling (Client- Side Desync) (CWE: 444)

Apache Tomcat from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43 are vulnerable to client-side de-sync attacks.

Client-side de-sync (CSD) vulnerabilities occur when a web server fails to correctly process the Content-Length of POST requests. By exploiting this behavior, an attacker can force a victim's browser to de-synchronize its connection with the website, causing sensitive


[Uncontrolled Resource Consumption] Denial of Service caused by HTTP/2 CONTINUATION Flood

I sent the following report to Apache Tomcat Security Team. They confirmed the report and assigned CVE-2024-24549. I'd like to ask if this is eligible for a bounty.

I'd like to report a DoS vulnerability in Tomcat. I tested 10.1.18 and 11.0 (tomcat:latest and tomcat:11.0 docker images respectively) and it seems that both are vulnerable.

An attacker can send headers using HTTP/2 CONTINUATION frames up to


[Uncontrolled Resource Consumption] CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()

# TL;DR

**CVE-2024-27351**: Potential regular expression denial-of-service in `django.utils.text.Truncator.words()`

# Details:

`django.utils.text.Truncator.words()` method (with `html=True`) and `truncatewords_html` template filter were subject to a potential regular expression denial-of-service attack using a suitably crafted string (follow up to CVE-2019


[Misinterpretation of Input] CVE-2024-2004: Usage of disabled protocol

## Summary:
` --proto` in some circumstances ENABLES all protocols after being given `-all`, potentially leading to sending sensitive data over an unencrypted channel.

## Steps To Reproduce:
`curl -Ivs --proto -all,-http http://curl.se`
This command should result in `curl: (1) Protocol "http" disabled` but it actually succeeds.

## Supporting Material/References:
The example command above performs a request to curl.se over


[Server-Side Request Forgery (SSRF)] Libuv: Improper Domain Lookup that potentially leads to SSRF attacks

I recently encountered a challenge in a CTF competition that led me to discover a vulnerability within Node.js, present in all versions after v10. Upon further investigation and code debugging, it became apparent that the vulnerability originated from its direct dependency, `libuv`.

I submitted a report to the Node.js team via HackerOne, and they subsequently connected me with the libuv te


[Unknown] CVE-2024-2398: HTTP/2 push headers memory-leak

A memory leak was found in libcurl in handling HTTP/2 push headers, which could lead to a denial of service due to memory exhaustion.
Original report: https://hackerone.com/reports/2402845

## Impact

denial of service


[Improper Certificate Validation] CVE-2024-2379: QUIC certificate check bypass with wolfSSL

## Summary:
In `vquic-tls.c` `curl_wssl_init_ctx` errors are handled by `goto out` and having `result` be set to an error code to be returned. At the beginning of the function `result` is correctly set to `CURLE_FAILED_INIT` which allows for `goto out` to work correctly without having to set `result` however, `result`'s value is overridden at a certain point  if `ctx_setup` is passed to the function. If


[Uncontrolled Resource Consumption] http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks

I'd like to report Node.js vulnerability (CVE-2024-22019) that was recently fixed:
- HackerOne report: https://hackerone.com/reports/2233486
- Release notes: https://nodejs.org/en/blog/vulnerability/february-2024-security-releases

## Impact

This is a major issue because it allows unbounded resource (CPU, network bandwidth) consumption of the standard Node.js http server


[Uncontrolled Resource Consumption] Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

I'd like to report Apache httpd vulnerability (CVE-2024-27316) that was recently fixed.
* Advisory: https://httpd.apache.org/security/vulnerabilities_24.html

## Impact

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.


[Unknown] CVE-2024-0853: OCSP verification bypass with TLS session reuse

Original Report:https://hackerone.com/reports/2298922

## Impact

CWE-299: Improper Check for Certificate Revocation


[Improper Certificate Validation] CVE-2024-2466: TLS certificate check bypass with mbedTLS (reward request)

For reward request.

Please refer to this report issue from curl:
https://hackerone.com/reports/2416725

And already published at here:
https://curl.se/docs/CVE-2024-2466.html

## Impact

Reference from above.


[Improper Certificate Validation] CVE-2024-2379: QUIC certificate check bypass with wolfSSL

See https://hackerone.com/reports/2410774 or https://curl.se/docs/CVE-2024-2379.html

## Impact

See https://hackerone.com/reports/2410774 or https://curl.se/docs/CVE-2024-2379.html


[Improper Authentication - Generic] CVE-2024-25128: Apache Airflow: Authentication Bypass when Legacy OpenID(2.0) is in use as AUTH_TYPE

When OpenID(2.0) is in use as Authentication Type, it is possible for an attacker to forge authentication to any existing account in the Target Airflow installation. This was possible via deceiving the backend of app to trust arbitrary OpenID 2.0 Identity Provider(even if the provider is not in the trusted IDP list in config). In conclusion, an attacker could


[Improper Validation of Certificate with Host Mismatch] CVE-2024-2466: TLS certificate check bypass with mbedTLS

## Summary:

Curl library has a security vulnerability where the certificate name check is bypassed when connecting to a host via its IP address. This could potentially introduce spoofing attacks or unauthorized access due to unverified server certificate.

This issue only affects the Curl with MbedTLS.

- Affected versions: from libcurl 8.5.0 to and including 8.6.0 (current master v


[Uncontrolled Resource Consumption] CVE-2024-2398: HTTP/2 push headers memory-leak

## Summary:
For each incoming `PUSH_PROMISE` header a new `name:value` string is allocated
and the pointer to that string is stored in the `stream->push_headers` array.

```
h = aprintf("%s:%s", name, value);
    if(h)
      stream->push_headers[stream->push_headers_used++] = h;
```

Libcurl will reject `PUSH_PROMISE` frames with too many headers.
When the number of headers exceeds some threshold, `on_header` re


[Unknown] CVE-2024-27281: RCE vulnerability with .rdoc_options in RDoc

I made a report at https://hackerone.com/reports/1187477

https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/

> An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.
> When parsing .rdoc_options (used for configuration in RDoc) as a YAML file, object injection and resultant remote code execution are possible because there are no restrictions on the classes that can


[Improper Check for Certificate Revocation] CVE-2024-0853: OCSP verification bypass with TLS session reuse

## Summary:
In version 8.5.0, cURL has inadvertently established a pathway for accepting revoked certificates.
As a result of [this correction](https://github.com/curl/curl/pull/12418/commits/7cf0391bbc3b5b2e4402ce675124cd73dbe0187e), during TLS session reuse, OCSP stapling verification will be skipped.
However, the TLS session will be preserved regardless of OCSP verification results.
A


[Seebug SSV-99967] Ivanti Endpoint Manager Mobile代码注入漏洞
Severity: high
Date: 2026-02-03
CVE: CVE-2026-1281, CVE-2026-1340


[Seebug SSV-99966] 无人机开源飞控 PX4-Autopilot堆栈溢出漏洞 CVE-2025-15150
Severity: high
Date: 2025-12-30
CVE: CVE-2025-15150


[Seebug SSV-99965] MongoDB内存泄漏 CVE-2025-14847
Severity: high
Date: 2025-12-29
CVE: CVE-2025-14847


[Seebug SSV-99927] 1Panel 代理证书验证绕过导致任意命令执行漏洞(CVE-2025-54424)
Severity: high
Date: 2025-08-05
CVE: CVE-2025-54424


[Seebug SSV-99926] Citrix NetScaler 内存泄漏(CVE-2025-5777)
Severity: high
Date: 2025-07-11
CVE: CVE-2025-5777


[Seebug SSV-99925] ModelContext Inspector 未授权访问漏洞(CVE-2025-49596)
Severity: high
Date: 2025-06-17
CVE: CVE-2025-49596


[Seebug SSV-99924] llamaindex SQL 注入漏洞(CVE-2025-1750)
Severity: high
Date: 2025-06-03
CVE: CVE-2025-1750


[Seebug SSV-99923] Screen 本地权限提升漏洞(CVE-2025-23395)
Severity: mid
Date: 2025-05-16
CVE: CVE-2025-23395


[Seebug SSV-99922] Craft CMS 验证后模版注入导致远程命令执行漏洞(CVE-2025-46731)
Severity: high
Date: 2025-05-06
CVE: CVE-2025-46731


[Seebug SSV-99920] CentreStack & Triofox 反序列化漏洞(CVE-2025-30406)
Severity: high
Date: 2025-04-24
CVE: CVE-2025-30406


[Seebug SSV-99919] CrushFTP 认证绕过漏洞(CVE-2025-2825)
Severity: high
Date: 2025-03-31
CVE: CVE-2025-2825


[Seebug SSV-99918] Vite 任意文件读取漏洞(CVE-2025-30208)
Severity: high
Date: 2025-03-27
CVE: CVE-2025-30208


[Seebug SSV-99917] Next.js 中间件权限绕过漏洞(CVE-2025-29927)
Severity: high
Date: 2025-03-24
CVE: CVE-2025-29927


[Seebug SSV-99916] Apache Camel 任意命令执行漏洞(CVE-2025–27636 & CVE-2025-29891)
Severity: high
Date: 2025-03-13
CVE: CVE-2025-29891


[Seebug SSV-99914] trojan多用户管理部署程序 Login bypass(CVE-2024-55215)
Severity: high
Date: 2025-02-08
CVE: CVE-2024-55215


[Seebug SSV-99913] Palo Alto Expedition RCE 漏洞（CVE-2025-0107）
Severity: high
Date: 2025-01-23
CVE: CVE-2025-0107


[Seebug SSV-99912] 漏洞名称: totolink a810r 命令注入漏洞（CVE-2024-57036）
Severity: high
Date: 2025-01-23
CVE: CVE-2024-57036


[Seebug SSV-99911] xz-utils软件包liblzma库存在后门（CVE-2024-3094）
Severity: high
Date: 2025-01-17
CVE: CVE-2024-3094


[Seebug SSV-99910] Aviatrix 网络控制器命令注入漏洞（CVE-2024-50603）
Severity: high
Date: 2025-01-08
CVE: CVE-2024-50603


[Seebug SSV-99909] DrayTek Vigor2960/Vigor300B 命令注入漏洞(CVE-2024-12987)
Severity: high
Date: 2025-01-02
CVE: CVE-2024-12987


[Seebug SSV-99908] Craft CMS 未经身份验证 RCE(CVE-2024-56145)
Severity: high
Date: 2024-12-24
CVE: CVE-2024-56145


[Seebug SSV-99907] Databricks JDBC 驱动程序 JNDI 注入（CVE-2024-49194）
Severity: high
Date: 2024-12-20
CVE: CVE-2024-49194


[Seebug SSV-99906] Apache Tomcat 条件竞争致远程代码执行漏洞（CVE-2024-50379）
Severity: high
Date: 2024-12-18
CVE: CVE-2024-50379


[Seebug SSV-99905] Apache Struts 目录遍历导致文件上传RCE漏洞（CVE-2024-53677）
Severity: high
Date: 2024-12-16
CVE: CVE-2024-53677


[Seebug SSV-99904] WordPress-Umbrella插件本地文件包含漏洞(CVE-2024-12209)
Severity: high
Date: 2024-12-10
CVE: CVE-2024-12209


[Seebug SSV-99903] Windows辅助功能的WinSock特权提升漏洞(CVE-2024-38193)
Severity: high
Date: 2024-12-09
CVE: CVE-2024-38193


[Seebug SSV-99902] Zabbix认证后SQL注入漏洞(CVE-2024-42327)
Severity: high
Date: 2024-12-03
CVE: CVE-2024-42327


[Seebug SSV-99901] ProjectSend认证绕过漏洞(CVE-2024-11680)
Severity: high
Date: 2024-11-28
CVE: CVE-2024-11680


[Seebug SSV-99900] Sitecore CMS未经身份验证任意文件读取漏洞(CVE-2024-46938)
Severity: high
Date: 2024-11-26
CVE: CVE-2024-46938


[Seebug SSV-99899] Palo Alto Networks PAN-OS身份认证绕过漏洞（CVE-2024-0012）
Severity: high
Date: 2024-11-20
CVE: CVE-2024-0012


[Seebug SSV-99898] Fortinet FortiManager 未授权RCE（CVE-2024-47575）
Severity: high
Date: 2024-11-19
CVE: CVE-2024-47575


[Seebug SSV-99897] WordPress-ReallySimpleSecurity插件认证绕过漏洞(CVE-2024-10924)
Severity: high
Date: 2024-11-15
CVE: CVE-2024-10924


[Seebug SSV-99896] Citrix Virtual Apps and Desktop 7 (CVE-2024-8069)
Severity: high
Date: 2024-11-14
CVE: CVE-2024-8069


[Seebug SSV-99895] D-Link NAS Command Injection（CVE-2024-10914、CVE-2024-10915）
Severity: high
Date: 2024-11-07
CVE: CVE-2024-10914, CVE-2024-10915


[Seebug SSV-99894] ZoneMinder开源视频监控平台SQL注入漏洞(CVE-2024-51482)
Severity: high
Date: 2024-11-05
CVE: CVE-2024-51482


[Seebug SSV-99893] JeecgBoot SQL injection（CVE-2024-48307）
Severity: high
Date: 2024-11-01
CVE: CVE-2024-48307


[Seebug SSV-99892] PyTorch库RPC框架反序列化RCE漏洞(CVE-2024-48063)
Severity: high
Date: 2024-10-31
CVE: CVE-2024-48063


[Seebug SSV-99891] Apache Solr 身份认证绕过漏洞（CVE-2024-45216）
Severity: high
Date: 2024-10-30
CVE: CVE-2024-45216


Pachno 1.0.6 FileCache Deserialization Remote Code Execution

Severity: high


Pachno 1.0.6 (runSwitchUser()) Remote Vertical Privilege Escalation

Severity: high


Pachno 1.0.6 Wiki TextParser XXE Vulnerability

Severity: high


Pachno 1.0.6 Cross-Site Request Forgery

Severity: high


Pachno 1.0.6 (uploadfile) Unrestricted File Upload Remote Code Execution

Severity: high


Pachno 1.0.6 (return_to) Open Redirection

Severity: medium


Pachno 1.0.6 Stored Cross-Site Scripting

Severity: high


Honeywell Trend IQ4xx BMS Controller Unauthenticated Remote Web-HMI Control And Lockout

Severity: critical


Tattile Cameras 1.181.5 Unauthenticated RTSP Stream Disclosure

Severity: medium


Tattile Cameras 1.181.5 Use of Default Credentials

Severity: critical


Tattile Cameras 1.181.5 Insufficient Token (X-User-Token) Expiration

Severity: medium


eNet SMART HOME server 2.3.1 (setUserGroup) Remote Privilege Escalation

Severity: high


eNet SMART HOME server 2.3.1 (resetUserPassword) Account Takeover

Severity: high


eNet SMART HOME server 2.3.1 (deleteUserAccount) Arbitrary User Deletion

Severity: high


eNet SMART HOME server 2.3.1 Use of Default Credentials

Severity: critical


JUNG Smart Visu Server 1.1.1050 Remote Server Shutdown

Severity: high


JUNG Smart Visu Server 1.1.1050 Request URL Override

Severity: high


JUNG Smart Panel 5.1 KNX Unauthenticated Absolute File Path Traversal

Severity: critical


Ilevia EVE X1/X5 Server 4.7.18.0.eden Authenticated Remote Command Injections

Severity: critical


Ilevia EVE X1/X5 Server 4.7.18.0.eden Root Privilege Escalation

Severity: critical


Ilevia EVE X1/X5 Server 4.7.18.0.eden Insecure Hashing Algorithm

Severity: medium


Ilevia EVE X1/X5 Server 4.7.18.0.eden Default Credentials

Severity: critical


Ilevia EVE X1 Server 4.7.18.0.eden (mbus) Unauthenticated Remote Command Injection

Severity: critical


Ilevia EVE X1 Server 4.7.18.0.eden Unauthenticated Reflected XSS

Severity: high


Ilevia EVE X1 Server 4.7.18.0.eden Parameter Traversal Arbitrary File Access

Severity: critical


Ilevia EVE X1/X5 Server 4.7.18.0.eden Reverse Rootshell

Severity: critical


Ilevia EVE X1/X5 Server 4.7.18.0.eden Authentication Bypass Exploit

Severity: critical


Ilevia EVE X1 Server 4.7.18.0.eden Credentials Leak Through Log Disclosure

Severity: critical


Ilevia EVE X1 Server 4.7.18.0.eden Neuro-Core Unauth Code Invasion

Severity: critical


Ilevia EVE X1 Server 4.7.18.0.eden (db_log) Pre-Auth File Disclosure

Severity: critical


Daikin Security Gateway v214 Remote Password Reset

Severity: critical


Ksenia Security Lares WebServer Home Automation Remote Code Execution

Severity: high


Ksenia Security Lares WebServer Home Automation PIN Logic Flaw

Severity: high


Ksenia Security Lares WebServer Home Automation URL Redirection

Severity: medium


Ksenia Security Lares WebServer Home Automation Default Credentials

Severity: critical


ABB Cylon FLXeon 9.3.4 Insecure Backup Sensitive Data Exposure

Severity: high


ABB Cylon FLXeon 9.3.4 (cert.js) System Logs Information Disclosure

Severity: high


ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability

Severity: high


ABB Cylon FLXeon 9.3.4 (wsConnect.js) WebSocket Command Spawning PoC

Severity: critical


ABB Cylon FLXeon 9.3.4 (users.js) Authenticated Root Remote Code Execution

Severity: critical


ABB Cylon FLXeon 9.3.4 (cert.js) Authenticated Root Remote Code Execution

Severity: critical


ABB Cylon FLXeon 9.3.4 (timeConfig.js) Authenticated Root Remote Code Execution

Severity: critical


ABB Cylon FLXeon 9.3.4 (upload.js) Authenticated Root Remote Code Execution

Severity: critical


ABB Cylon FLXeon 9.3.4 (cmds.js) Authenticated Root Remote Code Execution

Severity: critical


ABB Cylon FLXeon 9.3.4 (login.js) Unauthenticated Root Remote Code Execution

Severity: critical


ABB Cylon Aspect 3.08.02 (licenseServerUpdate.php) Stored Cross-Site Scripting

Severity: critical


ABB Cylon Aspect 3.08.02 (licenseUpload.php) Stored Cross-Site Scripting

Severity: critical


ABB Cylon Aspect 3.08.02 (uploadDb.php) Remote Code Execution

Severity: critical


ABB Cylon Aspect 3.08.02 (bbmdUpdate.php) Remote Code Execution

Severity: critical


ABB Cylon Aspect 3.08.02 (escDevicesUpdate.php) Off-by-One Config Write DoS

Severity: critical


ABB Cylon Aspect 3.08.02 (CookieDB) SQL Injection

Severity: critical


ABB Cylon Aspect 3.07.02 (userManagement.php) Weak Password Policy

Severity: medium


ABB Cylon Aspect 3.08.03 Hard-coded Secrets

Severity: critical


ABB Cylon Aspect 3.08.02 Cookie User Password Disclosure

Severity: high


ABB Cylon Aspect 3.08.02 (deployStart.php) Unauthenticated Command Execution

Severity: critical


ABB Cylon Aspect 3.08.02 (WatchDogServlet) Authenticated Reflected XSS

Severity: medium


ABB Cylon Aspect 3.08.02 (syslogUpdate.php) Remote Code Execution

Severity: high


ABB Cylon Aspect 3.08.02 (editOverride.php) Authentication Bypass MIX Override

Severity: critical


ABB Cylon Aspect 3.08.02 (aspectMemory.php) Arbitrary Heap Memory Configuration

Severity: high


ABB Cylon Aspect 3.08.02 Unauthenticated Configuration Disclosure

Severity: critical


ABB Cylon Aspect 3.08.02 (API/Servlets) Server-Side Request Forgery (SSRF)

Severity: critical


ABB Cylon Aspect 3.08.02 (altlogin.php) Unauthenticated Reflected XSS

Severity: critical


ABB Cylon Aspect 3.08.01 (oosManagerAjax.php) Information Manipulation

Severity: critical


ABB Cylon Aspect 3.08.01 (combinedStats.php) Information Disclosure

Severity: high


ABB Cylon Aspect 3.08.02 (fileSystemUpdate.php) Remote Guest2Root Exploit

Severity: critical


ABB Cylon Aspect 3.08.02 (userManagement.php) Cross-Site Request Forgery

Severity: critical


ABB Cylon Aspect 3.08.02 (servicesUpdate.php) Remote Code Execution

Severity: critical


ABB Cylon Aspect 3.08.02 (fileSystemUpdateExecute.php) Remote Code Execution

Severity: critical


ABB Cylon Aspect 3.08.01 (servicesUpdate.php) Remote Code Execution

Severity: critical


Akuvox Smart Intercom/Doorphone ServicesHTTPAPI Improper Access Control

Severity: high


ABB Cylon Aspect 3.07.01 (config.inc.php) Hard-coded Credentials in phpMyAdmin

Severity: critical


ABB Cylon Aspect 3.08.01 (bigUpload.php) Remote Code Execution

Severity: critical


ABB Cylon Aspect 3.08.01 (databaseFileDelete.php) Arbitrary File Delete

Severity: critical


Akuvox Smart Intercom/Doorphone Unauthenticated Stream Disclosure

Severity: medium


Deep Sea Electronics DSE855 Remote Authentication Bypass

Severity: critical


Aquatronica Control System 5.1.6 Passwords Leak Vulnerability

Severity: critical


Elber ESE DVB-S/S2 Satellite Receiver 1.5.x Device Config

Severity: critical


Elber ESE DVB-S/S2 Satellite Receiver 1.5.x Authentication Bypass

Severity: critical


Positron Broadcast Signal Processor TRA7005 v1.20 _Passwd Exploit

Severity: critical


Tosibox Key Service 3.3.0 Local Privilege Escalation

Severity: medium


TELSAT marKoni FM Transmitter 1.9.5 Insecure Access Control Change Password

Severity: high


TELSAT marKoni FM Transmitter 1.9.5 Client-Side Access Control Bypass

Severity: high


TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account

Severity: critical


TELSAT marKoni FM Transmitter 1.9.5 Root Command Injection PoC Exploit

Severity: critical


R Radio Network FM Transmitter 1.07 system.cgi Password Disclosure

Severity: critical


TitanNit Web Control 2.01 / Atemio 7600 Root Remote Code Execution

Severity: critical


TEM Opera Plus FM Family Transmitter 35.45 XSRF

Severity: high


TEM Opera Plus FM Family Transmitter 35.45 Remote Code Execution

Severity: critical


VIMESA VHF/FM Transmitter Blue Plus 9.7.1 (doreboot) Remote Denial Of Service

Severity: high


Electrolink FM/DAB/TV Transmitter Pre-Auth MPFS Image Remote Code Execution

Severity: critical


Electrolink FM/DAB/TV Transmitter Unauthenticated Remote DoS

Severity: high


Electrolink FM/DAB/TV Transmitter SuperAdmin Hidden Functionality

Severity: high


Electrolink FM/DAB/TV Transmitter Vertical Privilege Escalation

Severity: high


Electrolink FM/DAB/TV Transmitter Remote Authentication Removal

Severity: critical


Electrolink FM/DAB/TV Transmitter (Login Cookie) Authentication Bypass

Severity: critical


Electrolink FM/DAB/TV Transmitter (controlloLogin.js) Credentials Disclosure

Severity: critical


Electrolink FM/DAB/TV Transmitter (login.htm/mail.htm) Credentials Disclosure

Severity: critical


Anevia Flamingo XL 3.2.9 (login) Remote Root Jailbreak

Severity: high


MiniDVBLinux 5.4 Remote Root Command Injection Vulnerability

Severity: critical


BEWARD N100 H.264 VGA IP Camera M2.1.6 Root Remote Code Execution

Severity: high


EnGenius EnShare IoT Gigabit Cloud Service 1.4.11 Root Remote Code Execution

Severity: critical


Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Code Execution

Severity: critical